Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label WiFi. Show all posts
Wifi vulnerability
Cyber Security Hacking Risk Information Security Public Wifi VPN WiFi Wifi vulnerability

Hidden Dangers of Public Wi-Fi: What A Traveler Needs To Know

 

Public Wi-Fi networks have become ubiquitous in our modern world, offering convenience and connectivity to travellers and commuters alike. However, beneath the surface lies a web of hidden dangers that could compromise your privacy and security. As an expert in cybersecurity, it's crucial to shed light on these risks and provide travellers with the knowledge they need to protect themselves in an increasingly connected world. 

One of the most significant dangers of connecting to public Wi-Fi is the risk of falling victim to a cyberattack. These networks are often unsecured, making it easy for hackers to intercept sensitive information transmitted over them. From passwords to financial data, travellers risk exposing their most personal information to prying eyes. Another hidden danger of public Wi-Fi is the prevalence of rogue hotspots. 

These malicious networks are designed to mimic legitimate Wi-Fi networks, tricking unsuspecting users into connecting to them. Once connected, hackers can launch various attacks, from phishing scams to malware downloads, putting travellers' devices and data at risk. Furthermore, public Wi-Fi networks are often monitored by cybercriminals looking to steal valuable information from unsuspecting users. 

By intercepting unencrypted data packets, hackers can gain access to usernames, passwords, and other sensitive information, leaving travellers vulnerable to identity theft and fraud. To mitigate the risks associated with public Wi-Fi, travellers should take proactive measures to protect themselves and their data. One of the most effective ways to stay safe is to avoid connecting to public Wi-Fi networks altogether, especially when handling sensitive information such as online banking or email access. 

If connecting to public Wi-Fi is unavoidable, travellers should use a virtual private network (VPN) to encrypt their internet traffic and protect their data from prying eyes. Additionally, travellers should enable two-factor authentication on all their accounts to add an extra layer of security against unauthorized access. It's also essential for travellers to keep their devices and software up-to-date with the latest security patches and updates. 

By regularly updating their devices, travellers can patch known vulnerabilities and reduce the risk of falling victim to cyberattacks. In conclusion, while public Wi-Fi networks offer convenience and connectivity to travellers, they also pose significant risks to privacy and security. By staying vigilant and taking proactive measures to protect themselves and their data, travellers can minimize the hidden dangers of public Wi-Fi and enjoy a safer and more secure travel experience.
Read more »
WiFi
Consumer Geofencing Mobile Security Technology WiFi

Geofencing: A Tech Set to Transform the Consumer Landscape?

Geofencing

One technological advancement that is subtly changing the marketing and customer engagement scene is Geofencing. It effortlessly connects your device to companies and services by drawing virtual borders around real-world locations. As soon as you cross these lines, you get relevant messages that are tailored to your area, including discounts, event reminders, or special offers.

Even if this technology helps some industries more than others, it poses serious privacy issues because it tracks your whereabouts and may generate issues with consent and data protection.

Let's examine the workings of this technology, consider how important your mobile device is to this procedure, and consider the privacy issues in more detail.

Geofencing: What is it?

Digital technology known as "geofencing" creates imaginary borders around a predetermined region. It's similar to encircling a location, such as a park, coffee shop, or neighborhood, with an invisible fence on a map.

As people enter or leave these designated regions, this equipment keeps an eye on gadgets like cell phones that depend on GPS, WiFi, or cellular data. Additionally, it monitors the movement of radio-frequency identification (RFID) tags—compact devices that wirelessly transmit data, similar to contactless vehicle keys—across these virtual boundaries.

How does Geofencing work?

1. Specifying the Geofence: To establish a geofence around their store, a retailer first chooses a location and then enters geographic coordinates into software to create an invisible boundary.

This could cover the immediate vicinity of the store or cover a broader neighborhood, establishing the context for the activation of particular digital activities.

2. Granting Access to Location Data: For geofencing to function, users must allow location access on their cell phones. With this authorization, the device can use:

  • GPS for accurate location monitoring
  • WiFi uses neighboring networks to estimate closeness
  • Cellular data uses cell towers to triangulate the device's location

These permissions guarantee that the device's position can be precisely detected by the system. (We'll talk about the privacy issues this has raised later.)

3. Getting in or out of the fence: The geofencing system tracks a customer's smartphone location in the geofenced geographical area as they get closer to the store. When a consumer enters this region, the system is triggered to identify their entry based on the GPS data that their smartphone continuously provides.

4. Setting Off an Event: A predetermined action, such as delivering a push notification to the customer's smartphone, is triggered by this entry into the geofence.

The action in this retail scenario could be a notification with a marketing message or a unique discount offer meant to entice the customer by offering something of value when they are close to the business.

5. Carrying Out the Response: The customer knows a promotion or discount has been sent straight to their smartphone with a notice that appears on their device.

The customer's experience can be greatly improved by this prompt and location-specific interaction, which may result in more people visiting the store and a greater rate of sales conversion.

Industries where Geofencing is used

  1. Child Safety and Elderly Care
  2. Workforce Management
  3. Smart Home Automation
  4. Transport and Logistics

Future and Geofencing

Geofencing technology is anticipated to undergo a substantial transformation in 2024 and beyond, mostly because of the progress made in IoT (Internet of Things) technology. IoT encompasses physical objects, automobiles, household appliances, and other products that are integrated with sensors, software, electronics, and communication.

Read more »
WiFi
Gadgets Hacking devices OMG cables Security Technology USB Nugget WiFi

Is Your Gadget Secretly a Security Risk?

 


In our digital world where everything connects, keeping our devices safe is like building a strong fortress. We all know the basics – use strong passwords and be careful with downloads. But there's a hidden world of dangers that doesn't shout for attention. These dangers hide in plain sight, disguised as everyday gadgets we use. Imagine them as silent troublemakers wearing innocent masks. Today, we're going to see right through this world and discover the not-so-friendly surprises behind the gadgets we thought were harmless. 

1. Flipper Zero

Disguised as an innocent child's toy, the Flipper Zero, with a price tag of $169, extends its capabilities far beyond its facade. This unassuming gadget boasts an impressive array of features, including the ability to clone RFID cards, control infrared devices, and even masquerade as a keyboard. Posing as a harmless plaything, it is equipped to send commands to connected computers or smartphones, showcasing its multifunctional yet discreet nature.

2. O.M.G Cables

Operating undercover as regular charging cables, O.MG cables reveal a hidden computer with malicious intent upon connection. These covert keyboards, camouflaged as everyday charging accessories, can stealthily pilfer Wi-Fi passwords, copy files, and execute various other malicious actions. The elite version takes deception to the next level by connecting to Wi-Fi, triggering remotely, and even self-destructing to erase any traces of its surreptitious activities.

3. USBKill

Presented as innocent USB flash drives, USBKill devices harbour the potential for disruptive electrical charges when connected to any unsuspecting device. Whether triggered by a button, Bluetooth, timed attack, or a covert magnetic ring, these seemingly harmless gadgets underscore the inherent risks associated with indiscriminately connecting unknown USB devices. Laptops, PCs, smartphones – no device is immune to their potentially destructive capabilities.

4. USB Nugget

Beyond its charming exterior resembling a kitty, the USB Nugget harbours a darker secret – the potential to drop malicious payloads onto any unsuspecting connected device. This seemingly innocent and adorable gadget serves as a stark reminder of how even the simplest-looking devices can conceal formidable threats, highlighting the need for cautiousness when dealing with seemingly harmless peripherals.

5. Wi-Fi Pineapple

The Wi-Fi Pineapple, presenting itself as a futuristic router, transcends its appearance, concealing sophisticated capabilities that can significantly compromise wireless networks. This discreet platform for wireless network attacks can create rogue access points, monitor data from nearby devices, and capture Wi-Fi handshakes. Its unassuming guise masks the potent yet discreet threats that exist in the technical world. 

6. USB Rubber Ducky

Camouflaged as a standard flash drive, the USB Rubber Ducky assumes the role of a covert typist, emulating human keystrokes into connected devices. Its discreet nature allows it to remain undetected for extended periods, emphasising the imperative need for caution when plugging in unknown devices.

7. LAN Turtle

It appears as a generic USB ethernet adapter, the LAN Turtle conceals powerful tools for network surveillance. With features such as network scanning, DNS spoofing, and alerts for specific network traffic, it operates discreetly, potentially eluding detection for extended periods. This unassuming device highlights the subtle yet potent threats associated with covert network monitoring.

8. O.MG Unblocker

Presenting itself as a data blocker, the O.MG Unblocker not only fails to fulfil its supposed function but also acts as an O.MG cable, enabling data theft or the delivery of malicious payloads. This deceptive device surfaces the importance of vigilance in an era where even seemingly protective accessories may harbour hidden dangers.

And that's the lowdown on our everyday gadgets – they might seem all harmless and friendly, but who knew they could have a mischievous side? So, the next time you plug in a cable or connect a device, remember, it could be up to something more than meets the eye. Stay cautious. 

Read more »
WiFi
Airport Security Cyber Security Hackers IT Network Public Network security measures Sensitive Information VPN WiFi

Navigating the Risks: Is Airport Wi-Fi Safe for Travelers?

Airport Wi-Fi has become a need for travelers in a time when keeping connected is crucial. It acts as a lifeline for anything from last-minute travel adjustments to professional correspondence. However, worries about its security have led some people to wonder whether utilizing public networks comes with any inherent risks.

According to a report by Explore.com, accessing airport Wi-Fi networks might not be as secure as one would hope. The convenience it offers often comes at the cost of compromised cybersecurity. Cybercriminals can exploit vulnerabilities in these networks, potentially gaining access to sensitive information.

Aura, a cybersecurity company, emphasizes that travelers should exercise caution when connecting to airport Wi-Fi. "Public networks are prime targets for cyberattacks. It's like leaving your front door unlocked in a high-crime area," warns their security expert. Hackers can employ various techniques, such as "Man-in-the-Middle" attacks, to intercept data transmitted over these networks.

MarketSplash echoes these concerns, urging travelers to take proactive measures. Using a Virtual Private Network (VPN) is one of the most effective ways to secure online activities. A VPN creates a secure tunnel between the device and the internet, encrypting data and making it significantly harder for cybercriminals to intercept.

Additionally, it's advised to avoid accessing sensitive information, like banking accounts or private emails, while on public Wi-Fi. Instead, it's safer to use cellular data or wait until connecting to a trusted network.

While these warnings might sound alarming, it's important to note that not all airport Wi-Fi networks are equally risky. Some airports invest heavily in cybersecurity measures, offering safer browsing experiences. As a rule of thumb, using well-known airports and verifying the network's legitimacy can reduce risks.

Airport Wi-Fi is a useful tool for travelers, but it's important to be aware of any security hazards. One can find a balance between staying connected and remaining secure by taking steps like using a VPN and avoiding important tasks on public networks. Better safe than sorry, as the saying goes. Travelers can avoid future hassles by making a minor investment in cybersecurity.
Read more »
WiFi
Kaspersky Phishing Attacks User Privacy VPN Vulnerabilities and Exploits. WiFi

The Safety of VPN Use: A Closer Look

The usage of Virtual Private Networks (VPNs) has experienced an unprecedented surge in recent years, as individuals and organizations seek enhanced online privacy and security. However, amidst this widespread adoption of VPNs, it is crucial to question whether users are truly safeguarded in their digital endeavors. 

According to a recent report by Cybersecurity Insiders and Zscaler, VPN usage has reached an all-time high, with 78% of organizations employing VPN services to safeguard their network traffic. Additionally, a study conducted by Security.org revealed that 30% of internet users globally rely on VPNs for various purposes, including bypassing geo-restrictions, securing public Wi-Fi connections, and shielding their digital footprints from prying eyes.

While VPNs offer several benefits, such as encryption and anonymity, it is crucial to understand that not all VPNs are created equal. Some low-quality or free VPN services may pose significant risks to users' online safety. Dr. Max Vetter, Chief Cyber Officer at Immersive Labs, emphasizes this concern, stating, "A VPN is only as secure as its provider. Users must exercise caution when selecting a VPN service, as not all providers prioritize security and privacy."

In the pursuit of privacy and security, users often overlook the fact that their VPN provider may still have access to their online activities. Some VPN companies log user data, including browsing history and connection timestamps, raising concerns about privacy breaches. To ensure maximum protection, it is essential to choose a reputable VPN service that follows a strict no-logging policy.

Moreover, a VPN cannot shield users from all threats. It encrypts internet traffic and masks IP addresses, making it difficult for hackers or cybercriminals to intercept data. However, users must remain vigilant against other online risks, such as phishing attacks, malware, and social engineering. As Denis Legezo, Security Expert at Kaspersky, advises, "VPNs are not a panacea. They must be used in conjunction with other cybersecurity measures to ensure comprehensive protection."

It is worth noting that VPNs are not immune to vulnerabilities themselves. A recent industry report by Zscaler highlights that 91% of VPN services exhibit at least one potential security vulnerability. These vulnerabilities range from outdated protocols to weak encryption standards, putting users at risk. Regularly updating VPN software and opting for services with robust security protocols are essential steps in mitigating such vulnerabilities.
Read more »
WiFi
Cyber Security Data Network Security Safety WiFi

How to Prevent Home Network Hackers? Here's all you Need to Know

 

Your home Wi-Fi network may not be as secure as you believe. Internet crime costed Americans more than $6.9 billion in 2021. Personal data breaches were also significant, in addition to phishing and scams. Many personal data breaches could have been avoided with a little home network security. The average household in the United States has more than ten devices connected to its home Wi-Fi network. 

The number of devices ranging from laptops and tablets to phones, smartwatches, and streaming devices can quickly grow, and each is potentially vulnerable to hacking. With so much data stored on those devices – credit card numbers, bank records, login credentials, and other personal and private information – you want to make sure you're protected from hackers if your network is compromised.

A secure home network minimizes the risk of being hacked and having someone gain access to sensitive information. Furthermore, it will keep unwanted or unauthorized users and devices from slowing down your connection or freeloading on the internet service you pay for.

How to Protect Your Home WiFi Network

Here are the fundamentals for safeguarding your home Wi-Fi network. 

1. Make a strong Wi-Fi password and change it frequently.
It is critical to creating a unique password for your Wi-Fi network in order to maintain a secure connection. Avoid passwords or phrases that are easily guessed, such as someone's name, birthday, phone number, or other common information. Simple Wi-Fi passwords are easy to remember, but they are also easy for others to figure out

2. Activate the firewall and Wi-Fi encryption.
Most routers include a firewall to prevent outside hacking and Wi-Fi encryption to prevent eavesdropping on data sent between your router and connected devices. Both are usually turned on by default, but you should double-check to make sure.

Now that you know how to access your router's settings, double-check that the firewall and Wi-Fi encryption are turned on. Turn them on if they're turned off for any reason. Your network security will appreciate it.

3. Turn off remote router access.
Anyone who is not directly connected to your Wi-Fi network can access the router settings via remote router access. There should be no reason to enable remote access unless you need to access your router while away from home (for example, to check or change the configuration of a child's connected device).

Remote access can be disabled in the router's admin settings. Disabling remote router access may not be the default, unlike other security measures.

While, even with the most up-to-date and effective methods of protecting your home network, security is never guaranteed. Hackers and cybercriminals will find ways to exploit the internet as long as it exists. However, by following the tips above, you can better protect your network from anyone attempting to use your connection or access your data.

Read more »
WiFi
Android DNS Flaw Domain malware Threat actor WiFi

 Roaming Mantis Virus Features DNS Setups


Malicious actors linked to the Roaming Mantis attack group were seen distributing an updated variation of their patented mobile malware called Wroba to compromise Wi-Fi routers and perform Domain Name System (DNS) theft.

Kaspersky found that the threat actor behind Roaming Mantis only targets routers made by a well-known South Korean network equipment manufacturer that is situated in that country.

Researchers have been tracking the Roaming Mantis malware distribution and credential theft campaign since September 2022. This malware uses an updated version of the Android malware Wroba. o/XLoader to identify susceptible WiFi routers based on its model and modify their DNS.

All Android devices connected to the WiFi network will now experience a redirect to the malicious landing page and a request to install the malware as a result of the router's DNS settings having been altered. Consequently, there is a steady flow of infected devices that can penetrate secure WiFi routers on national public networks that serve a huge number of users.

The attacks use smishing messages as their primary intrusion vector to deliver a booby-trapped URL that, depending on the mobile device's operating system, either provides a malicious APK or directs the user to phishing URLs.

Even though there are no landing pages for American targets and Roaming Mantis does not seem to be specifically targeting American router models, Kaspersky's telemetry reveals that 10% of all XLoader victims are in the United States.

Additionally, the feature was set up to primarily target WiFi routers in South Korea, according to security researchers. Roaming Mantis victims have also been spotted in France, Japan, Germany, the US, Taiwan, Turkey, and other countries.

Kaspersky experts advise consulting one's router's user manual to ensure that its DNS settings have not been modified or contacting your ISP for assistance to safeguard the internet connection from such a virus. Furthermore, updating your router's firmware regularly from the official source is advised, as is changing the router's default login and password for the admin web interface. Avoid using a third-party repository and do not install router firmware from outside sources.
Read more »
WiFi
Cyber Security IP Address Public Network User Privacy VPN WiFi

When Using Open Wi-Fi, Users Don't Employ a VPN

A VPN is a software program that masks the actual IP address and encrypts all data leaving any device. 
Using a VPN, enables users to connect to a secure network via a public network and transport all of the data into an encrypted channel, safeguarding their online activity. 

The user's authentic IP address is concealed and next-generation encryption is used to mask user activities when the web server is redirected via another private internet server.

The likelihood of connecting to free public Wi-Fi to stream a network, watch YouTube videos, or browse through social media feeds increases as a result. This is where one of the finest VPN services is useful and essential throughout the holiday season. 

A recent poll reveals that when connecting to a risky Wi-Fi, the majority of users continue to refrain from using such protection software. 

Business VPNs were not required in the past when cybersecurity experts were in high demand. To safeguard online activity in the present digital environment, each user must use a secure VPN. However, for individuals who frequently connect to open internet hotspots, it is all the more important. It appears that a majority of us still do not adhere to this crucial privacy-friendly habit, which is a concern.

More than 56% of participants in a recent survey of 1,000 American users aged 18 and older who use public Wi-Fi claimed they were not using a VPN. And to make matters harder, 41% do not use any encryption software at all.

The top travel hazards to be aware of this festive season have been compiled by cybersecurity company Lookout, which also makes antivirus software like Lookout Security and other security, privacy, and identity theft detection solutions.

Some of the key guidelines are as followed:
  • Stay aware of insecure Wi-Fi networks because hackers may conceal themselves behind a similar deceptive network to deceive careless passengers and steal their login information. 
  • Using USB charging outlets in public places can be risky.
  • Do not fall for travel-related phishing schemes, hackers may also attempt to con users using these scams.

Reliable VPN services are of utmost importance for browsing the web securely in any situation and avoiding prying governments and nefarious individuals from getting access to user data. 
 


Read more »
WiFi
Airline airline industry CVE CVE vulnerability Exploit Security Flaws Vulnerabilities and Exploits WiFi

Major Vulnerabilities Found in Wireless LAN Devices in Airlines

The two major vulnerabilities were found in the series of the flexlan, a LAN device providing internet services in airlines. The Necrum security labs’ researchers Samy Younsi and Thomas Knudsen, initiated the research which led to tracking two critical vulnerabilities which were identified as CVE-2022-36158 and CVE-2022-36159. 

The vulnerabilities were detected in the Flexlan series named FXA3000 and FXA2000 and have been associated with a Japan-based firm known as Contec. 
 
The researchers said while considering the first vulnerability, that during the execution of reverse engineering on firmware, we found a hidden web page, which was not entailed in the list of wireless LAN manager interfaces. They also added that it simplifies the enforcement of the Linux command over the device with root privileges. The researchers mentioned that the first vulnerability gave access to all the system files along with the telnet port which allows to access the whole device.   
 
Regarding the second vulnerability, the researchers said, it makes use of hard-coded, weak cryptographic keys and backdoor accounts. While carrying out the research, the researchers were also able to recover and get access to a shadow file within a few minutes with the help of a brute-force attack. The file contained the hash of two users including root and users. 
 
The researchers explained the issue that the device owner is only able to change the password from the interface of the web admin as the root account is reserved for maintenance purposes by Contec. This allows the attacker with a root hard-coded password able to access all Flexlan FXA2000 and FXA3000 series effortlessly. 
 
With respect to the solutions, researchers emphasized the importance of mentioned to maintaining cyber security, with regard to the first Vulnerability. They said, “the hidden engineering web pages should be removed from all unfortified devices. As weak passwords make access easier for cyber attackers.” For the second vulnerability, the advisory commented, “the company should create new strong passwords, for every single device with the manufacturing process."
Read more »
WiFi
Data Breach Data Leak Data Privacy User Data User Privacy VPN WiFi

Researchers: Wi-Fi Probe Requests Leak User Data

 

A team of academic researchers from the University of Hamburg in Germany discovered that Wi-Fi investigation requests from mobile devices expose identifiable information about their owners via Wi-Fi investigation requests. 

When a probe response is received, mobile devices use it to obtain information about nearby Wi-Fi access points and connect to them. According to the researchers, attackers who can sniff network traffic can use these probing requests to monitor and identify devices, as well as determine their position. 

According to them, nearly a quarter of probe requests contain the Service Set Identifiers (SSIDs) of previously connected networks, which might be exploited to expose home addresses or visited places. Furthermore, the researchers highlight that the probe requests may be used to trilaterate the position of a device with an accuracy of up to 1.5 metres or to "trace the movement of a device to effectively monitor its owner.

“This is in fact employed in 23% of the stores already. Companies and cities that conduct Wi-Fi tracking take the legal position that only the MAC address contained in probe requests is considered personal data according to GDPR Article 4(1), which protects personal data from unlawful collection and processing,” the researchers stated in their paper. 

Experiment findings:

According to the academics, information gathered during a November 2021 experiment focusing on the analysis of probe requests should be sufficient to deem these queries personal data, based only on SSIDs recorded in the devices' preferred network lists (PNLs). 

As part of the trial, the researchers travelled to a pedestrian area in a German city and recorded probe requests three times in one hour using six off-the-shelf antennas. SSIDs were found in 23.2 per cent of the 252,242 total requests. 

The researchers also determined that some of the submitted probe requests with SSIDs revealed password data and that around 20% of the transmitted SSIDs were likely typos of the genuine SSID. The probe requests also revealed 106 separate first and/or last names, three email addresses, the SSIDs of 92 distinct vacation houses or lodgings, and the name of a nearby hospital. 

The academics claim that they ran all SSIDs using WiGLE's geolocation lookup API, which allowed them to determine the actual networks' locations within a 1-kilometre radius. 

The researchers added, “Considering the wealth of personal and sensitive information we observed in SSID fields, they can constitute identifying information and thus require due consideration. We argue that at least for as long as there are still devices broadcasting SSIDs, probe requests should be considered personal data and not be used for monitoring without legal basis.” 
 
Read more »
WiFi
Android devices Bluetooth Bugs Fingerprints Flaws Research Vulnerabilities and Exploits WiFi

Hardware Bugs Provide Bluetooth Chipsets Unique Traceable Fingerprints

 

A recent study from the University of California, San Diego, has proven for the first time that Bluetooth signals may be fingerprinted to track devices (and therefore, individuals). At its root, the identification is based on flaws in the Bluetooth chipset hardware established during the manufacturing process, leading to a "unique physical-layer fingerprint."

The researchers said in a new paper titled "Evaluating Physical-Layer BLE Location Tracking Attacks on Mobile Devices, "To perform a physical-layer fingerprinting attack, the attacker must be equipped with a Software Defined Radio sniffer: a radio receiver capable of recording raw IQ radio signals." 

The assault is made feasible by the pervasiveness of Bluetooth Low Energy (BLE) beacons, which are constantly delivered by current smartphones to allow critical tasks such as contact tracking during public health situations. 

The hardware flaws come from the fact that both Wi-Fi and BLE components are frequently incorporated into a specialised "combo chip," effectively subjecting Bluetooth to the same set of metrics that may be utilized to uniquely fingerprint Wi-Fi devices: carrier frequency offset and IQ imbalance. 

Fingerprinting and monitoring a device, therefore, includes calculating the Mahalanobis distance for each packet to ascertain how similar the characteristics of the new packet are to its previously registered hardware defect fingerprint. 

"Also, since BLE devices have temporarily stable identifiers in their packets [i.e., MAC address], we can identify a device based on the average over multiple packets, increasing identification accuracy," the researchers stated. 

However, carrying out such an attack in an adversarial situation has numerous obstacles, the most significant of which is that the ability to uniquely identify a device is dependent on the BLE chipset employed as well as the chipsets of other devices in close physical distance to the target. Other key aspects that may influence the readings include device temperature, variations in BLE transmit power between iPhone and Android devices, and the quality of the sniffer radio utilised by the malicious actor to carry out the fingerprinting assaults. 

The researchers concluded, "By evaluating the practicality of this attack in the field, particularly in busy settings such as coffee shops, we found that certain devices have unique fingerprints, and therefore are particularly vulnerable to tracking attacks, others have common fingerprints, they will often be misidentified. BLE does present a location tracking threat for mobile devices. However, an attacker's ability to track a particular target is essentially a matter of luck."
Read more »
WiFi
Bugs DoS Firewall Flaws VPN Vulnerabilities and Exploits WiFi

Several Palo Alto Devices Affected by OpenSSL Flaw

 

In April 2022, Palo Alto Networks aims to patch the CVE-2022-0778 OpenSSL flaw in several of its firewall, VPN, and XDR devices. 

OpenSSL published fixes in mid-March to address a high-severity denial-of-service (DoS) vulnerability impacting the BN mod sqrt() function used in certificate parsing, which is tracked as CVE-2022-0778. Tavis Ormandy, a well-known Google Project Zero researcher, uncovered the issue. An attacker can exploit the flaw by creating a certificate with invalid explicit curve parameters. 

The advisory for this flaw read, “The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form.” 

“It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters.” 

The bug affects OpenSSL versions 1.0.2, 1.1.1, and 3.0, and the project's maintainers fixed it with the release of versions 1.0.2zd (for premium support customers), 1.1.1n, and 3.0.2. When parsing an invalid certificate, an attacker can cause the OpenSSL library to enter an infinite loop, resulting in a DoS condition, according to Palo Alto Networks. 

“All PAN-OS software updates for this issue are expected to be released in April 2022. The full fixed versions for PAN-OS hotfixes will be updated in this advisory as soon as they are available.” as per Palo Alto Network. 

During the week of April 18, the company is expected to provide security remedies for the above vulnerability. PAN-OS, GlobalProtect app, and Cortex XDR agent software, according to Palo Alto, have a faulty version of the OpenSSL library, whereas Prisma Cloud and Cortex XSOAR solutions are unaffected. 

“We intend to fix this issue in the following releases: PAN-OS 8.1.23, PAN-OS 9.0.16-hf, PAN-OS 9.1.13-hf, PAN-OS 10.0.10, PAN-OS 10.1.5-hf, PAN-OS 10.2.1, and all later PAN-OS versions. These updates are expected to be available during the week of April 18, 2022.” continues the advisory. 

Customers with Threat Prevention subscriptions can enable Threat IDs 92409 and 92411 to limit the risk of exploitation for this issue while waiting for PAN-OS security upgrades, according to the company.
Read more »
WiFi
Leak MENA Privacy User Data User Privacy User Security WiFi

Hotel WiFi Across MENA Compromised, Private Information Leaked

 

Etizaz Mohsin, a Pakistani cybersecurity researcher, was in a hotel room in Qatar when he accidentally discovered a technical vulnerability in the company's internet infrastructure, compromising the personal information of hundreds of hotels and millions of tourists worldwide. 

Mohsin explained, “I discovered that there is an rsync [file synchronisation tool] service running on the device that allows me to dump the device’s files to my own computer. I was able to gain access to all other hotels’ sensitive information that was being stored on the FTP [file transfer protocol] server for backup purposes.” 

He was able to get network configurations for 629 significant hotels in 40 countries, as well as millions of customers' personal information, such as room numbers, emails, and check-in and check-out dates. Information from major hotel chains in Qatar,, Turkey, the United Arab Emirates (UAE), Saudi Arabia, Lebanon, Egypt, Bahrain, Oman, Jordan, Kuwait, and Bahrain, as well as the Kempinski, Millennium, Sheraton, and St Regis in Qatar, Turkey, the United Arab Emirates (UAE), Saudi Arabia, Lebanon, Egypt, Bahrain, Oman, Jordan, Kuwait, and Bahrain was included in the research. 

The hotels all use AirAngel's HSMX Gateway internet technology, which is a British company. Some of the world's most well-known hotel chains are among its clients. Most hotels, stores, restaurants, and cafés need guests to set up an account and fill out their personal information before they may use the internet. It does, however, have some disadvantages. 

Mohsin added, “A public WiFi network is inherently less secure than the one you use at home. It gives hackers access to critical information like banking credentials and account passwords by allowing them to monitor and intercept data transferred across the network.”

Seven years ago, researchers discovered a flaw in hotel routers that affected 277 devices in hotels and convention centres in the US, Singapore, the United Kingdom, the United Arab Emirates, and 25 other countries.
Read more »
WiFi
Asus ASUS Routers attacks Botnet Cyber Attacks Cyclops Blink Routers Russia UK VPN WiFi

This New Russian Cyclops Blink Botnet Targets ASUS Routers

 

Nearly a month after it was discovered that the malware used WatchGuard firewall appliances as a stepping stone to obtaining remote access to infiltrated networks, ASUS routers have been the target of a budding botnet known as Cyclops Blink. 

The botnet's primary objective is to develop an infrastructure for additional attacks on high-value targets, according to Trend Micro, given that none of the compromised hosts belongs to vital organisations or those that have an obvious value on economic, political, or military espionage. 

Cyclops Blink has been identified by intelligence services in the United Kingdom and the United States as a replacement framework for VPNFilter, a malware that has targeted network equipment, especially small office/home office (SOHO) routers and network-attached storage (NAS) devices. 

Sandworm (aka Voodoo Bear), a Russian state-sponsored actor has been linked to both VPNFilter and Cyclops Blink. It has also been tied to several high-profile cyberattacks, including the 2015 and 2016 attacks on the Ukrainian electrical grid, the 2017 NotPetya attack, and the 2018 Olympic Destroyer attack on the Winter Olympic Games. 

The complex modular botnet, c language, affects a variety of ASUS router types, with the company admitting that it is working on a patch to handle any potential exploitation. –  
  • GT-AC5300 firmware under 3.0.0.4.386.xxxx
  • GT-AC2900 firmware under 3.0.0.4.386.xxxx
  • RT-AC5300 firmware under 3.0.0.4.386.xxxx
  • RT-AC88U firmware under 3.0.0.4.386.xxxx
  • RT-AC3100 firmware under 3.0.0.4.386.xxxx
  • RT-AC86U firmware under 3.0.0.4.386.xxxx
  • RT-AC68U, AC68R, AC68W, AC68P firmware under 3.0.0.4.386.xxxx
  • RT-AC66U_B1 firmware under 3.0.0.4.386.xxxx
  • RT-AC3200 firmware under 3.0.0.4.386.xxxx
  • RT-AC2900 firmware under 3.0.0.4.386.xxxx
  • RT-AC1900P, RT-AC1900P firmware under 3.0.0.4.386.xxxx
  • RT-AC87U (end-of-life)
  • RT-AC66U (end-of-life), and
  • RT-AC56U (end-of-life)
Apart from employing OpenSSL to encrypt connections with its command-and-control (C2) servers, Cyclops Blink also includes specific modules that can read and write from the devices' flash memory, allowing it to persist and survive factory resets. A second reconnaissance module acts as a medium for exfiltrating data from the hacked device to the C2 server, while a file download component is responsible for retrieving arbitrary payloads through HTTPS. Although the exact form of initial access is unknown, Cyclops Blink has been affecting WatchGuard and Asus routers in the United States, India, Italy, Canada, and Russia since June 2019. 

A law firm in Europe, a medium-sized entity producing medical equipment for dentists in Southern Europe, and a plumbing company in the United States are among the impacted hosts. Because of the infrequency with which IoT devices and routers are patched and the lack of security software, Trend Micro has warned that this might lead to the establishment of "eternal botnets."

The researchers stated, "Once an IoT device is infected with malware, an attacker can have unrestricted internet access for downloading and deploying more stages of malware for reconnaissance, espionage, proxying, or anything else that the attacker wants to do. In the case of Cyclops Blink, we have seen devices that were compromised for over 30 months (about two and a half years) in a row and were being set up as stable command-and-control servers for other bots."
Read more »
WiFi
Cyber Security News IoT Vulnerabilities and Exploits WiFi

Experts Discovered 226 Security Flaws in Nine Wi-fi Routers

 

Security experts and editors at CHIP (a German IT) have found 226 potential security faults in nine wi-fi routers from authentic manufacturers like AVM, Netgear, Asus, D-Link, TP-Link, Linksys, Edimax, and Synology. TP-Link Archer AX6000 router was the most affected by the flaws, according to cybersecurity experts, besides this, they also found 32 flaws, along with Synology RT-2600ac with 30 defects, and Netgear Nighthawk AX12 having 29 bugs. Experts also discovered around ten vulnerabilities in Netgear Nighthawk AX12, Edimax BR-6473AX, Asus ROG Rapture GT-AX11000, Linksys Velop MR9600, AVM FritzBox 7590 AX, and AVM FritzBox 7530 AX. 

The experts analyzed these network systems with the help of IoT Inspector's security platform, which searched around 1000 CVEs and security vulnerabilities. IoT CEO Jan Wendenburg said "changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network. The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto ‘plug, play and forget.” 

The most commonly found issues, according to cybersecurity researchers are out-of-date Linux kernel in the firmware, multimedia, and VPN features, existing hard-coded credentials, use of unsafe communication protocols, and weak security passwords. According to the security affairs advisory, "some of the security issues were detected more than once. Very frequently, an outdated operating system, i.e. Linux kernel, is in use. Since the integration of a new kernel into the firmware is costly, no manufacturer was up to date here. 

The device software used is also commonly found to be outdated, as it all too often relies on standard tools like BusyBox.” Experts observed that not all these faults can be compromised, false positives were also found. Experts discussed their findings with the manufacturers too, most of these vulnerabilities have been patched. Users are suggested to modify factory settings, make sure that devices install auto-updates, and stop functions that are not important.
Read more »
WiFi
Cyber Security Israel Network Security Security Researchers Weak Password WiFi

70% of WiFi Networks in Tel Aviv were Cracked by a Researcher

 

In his hometown of Tel Aviv, a researcher cracked 70% of a 5,000 WiFi network sample, demonstrating that residential networks are extremely vulnerable and easy to hijack. Ido Hoorvitch, a CyberArk security researcher, first strolled about the city center using WiFi sniffing equipment to collect a sample of 5,000 network hashes for the study. 

The researcher then took the use of a vulnerability that allowed the extraction of a PMKID hash, which is typically generated for roaming purposes. Hoorvitch sniffed with WireShark on Ubuntu and utilized a $50 network card that can function as a monitor and a packet injection tool to collect PMKID hashes. 

Although Hoorvitch highlighted that this form of attack does not require such heavy-duty technology, the team deployed a 'monster' cracking rig made up of eight xQUADRO RTX 8000 (48GB) GPUs in CyberArk Labs. The attack is centered on a weakness found by Hashcat's primary developer, Jens 'atom' Steube. This bug can be used to obtain PMKID hashes and crack network passwords.

"Atom’s technique is clientless, making the need to capture a user’s login in real-time and the need for users to connect to the network at all obsolete," explains Hoorvitch in the report. "Furthermore, it only requires the attacker to capture a single frame and eliminate wrong passwords and malformed frames that are disturbing the cracking process." 

The generation and cracking of PMKs with SSIDs and different passphrases can then be used to crack PMKID hashes collected by wireless sniffers with monitor mode enabled. This data is created from the right WiFi password when a PMKID is generated that is equal to the PMKID acquired from an access point. Hoorvitch employed a conversion tool and Hashcat, a password recovery software, after sniffing out PMKID hashes with the Hcxdumptool utility. 

According to Hoorvitch, many Tel Aviv residents use their cellphone numbers as their WiFi password, thus it wasn't long before hashes were cracked, passwords were obtained, and doors to their networks were opened. Each crack on the researcher's laptop took around nine minutes in these circumstances. The team was able to break into over 3,500 WiFi networks in and around Tel Aviv. 

Despite the risk of being hacked, most consumers do not set a strong password for their WiFi networks, according to the report. Passwords should be at least ten characters long, contain a mix of lower and upper case letters, symbols, and numerals, and be unique. Keeping your router firmware up to date will also safeguard your hardware from attacks based on vulnerability exploits, according to the researcher. WAP/WAP1 and other weak encryption protocols should be disabled as well.
Read more »
WiFi
Cyber Security NSA Public Network WiFi

NSA Issues Warning Concerning Public Wi-Fi Networks

 

National Security Agency cautioned public servants against hackers that can benefit from public Wi-Fi in coffee shops, airports, and hotel rooms. 

NSA stated, “The Biden administration would like you to get a vaccine and wear a mask. Oh, and one more thing: It has just proclaimed that it’s time for government employees and contractors to get off public Wi-Fi, where they can pick up another kind of virus.” 

The National Security Agency released a strangely specific warning late last week cautioning that logging in for public Wi-Fi Network “may be convenient to catch up on work or check email,” in a notification to every federal employee, leading defense companies and the 3.4 million uniformed, civil and reserves personnel serving on the military. In an eight-page report, the agency describes how the click on the local coffee shop's network caused problems in a year highlighted by ransomware attacks on pipelines, meatpackers, and even police forces in Washington, DC. 

“Avoid connecting to public Wi-Fi, when possible,” the warning read, stating that even Bluetooth connections can be compromised. 

Officials affirmed that they are completely aware that it is as likely that individuals will listen to the advice as they can be fully veiled outside in a baseball game. However, the message marks a turning moment, with the nation's primary signal intelligence agency aiming to throw on the brakes after a decade in which every restaurant, hotel, or airline has experienced competing for pressures to enhance its free Wi-Fi. 

This risk is not theoretical but is openly recognized and used for various malevolent approaches. The caution lies with readers on videos showing how easy is the use of an unsecured Wi-Fi network, which demands no passwords, yet the password collecting, and mobile phone content is for hackers which they can easily take access of. 

The alert by NSA, without mentioning specific occurrences, includes a warning that criminals or foreign intelligence agencies can generate open Wi-Fi infrastructures that look like they are from a hotel or a coffee house, but certainly are “an evil twin, to mimic the nearby expected public Wi-Fi.” 

Although the sudden surge in a crime or national adversaries exploiting public internet to rob data or to orchestrate hacks did not trigger the National Security Agency's cautions, Officials said. It instead seemed to be part of a much-increased US government's efforts in recent months to make people aware of a variety of technological vulnerabilities. 

Lately, President Biden had signed an Executive Order establishing several Cybersecurity criteria for software firms that sell to the federal government. Federal agencies must implement two-factor authentication as customers receive a text message, with a code, from their bank before entering their account details.
Read more »
WiFi
Bluetooth Cyber Security Radio Based Attack Smartphones WiFi

Safeguard Your Smartphones From Radio-based Attacks

 

Smartphones, unlike PCs, involve a range of radios – generally cellular, Wi-Fi, Bluetooth, and Near Field Communication (NFC) – that permit wireless communication in a variety of situations, and these radios are made to remain turned on while the user moves around the world. All smartphone users should be aware of the security implications of these wireless connections. 

Security flaws in these interfaces are a matter of concern, whether built into the protocol or discovered in a particular implementation. They can enable attackers to force connections to untrusted equipment, allowing them to extract data and even gain access to the target device. According to reports, RF-based tactics are used by sophisticated nation-state actors such as Russia and China, allegedly target people traveling through airports and other chokepoints. However, the tools for RF hacking are available to garden-variety hackers as well. 

Ways attackers engage in RF hacking: 

The IMSI catcher, also known as a cell-site simulator, false cell tower, rogue base station, StingRay, or dirtbox in cellular communications, is the biggest concern. An IMSI catcher is a piece of equipment that acts like a genuine cell tower, allowing a targeted smartphone to connect to it rather than the actual mobile network. It may be done using a variety of ways, such as impersonating a neighboring cell tower or using white noise to jam the competing 5G/4G/3G frequencies. 

The IMSI catcher places itself between the targeted smartphone and its cellular network after capturing the IMSI of the targeted smartphone. (the ID number connected to its SIM card). The IMSI catcher is then used to track the user's position, collect data from the phone, and, in some circumstances, even install spyware on the device. 

Unfortunately, there's no guaranteed method for the ordinary smartphone user to see or know they're connecting to a fraudulent cell tower, but there may be some hints: a notably slower connection or a change in a band in the phone's status bar. 

Though 5G in standalone mode promises to make IMSI catchers obsolete since the Subscription Permanent Identifier (SUPI) – 5G’s IMSI equivalent – is never exposed in the handshake between smartphone and cell tower. However, because these deployments account for a small percentage of all cellular networks, IMSI catchers will continue to be successful in the vast majority of situations in the near future. 

A Karma attack performed via a rogue access point is a critical danger to be mindful of on the Wi-Fi front. A rogue access point is often a Wi-Fi penetration testing device – the Wi-Fi Pineapple is one popular model – that is set up to attract unsuspecting users rather than auditing Wi-Fi networks. 

In a Karma attack, the rogue AP compromises a basic feature of smartphones and all Wi-Fi-enabled devices. When a smartphone's Wi-Fi is turned on but not connected to a network, the rogue AP broadcasts a preferred network list (PNL), which includes the SSIDs (Wi-Fi network names) of access points to which the device previously connected and is willing to reconnect to automatically without user intervention. 

The rogue AP provides itself an SSID from the PNL after getting this list, fooling the smartphone into thinking it's connected to a known Wi-Fi network. An intruder can spy on network traffic to acquire sensitive data after the targeted smartphone connects. This sort of attack is difficult to detect without continually monitoring the Wi-Fi indicator in the status bar. 

Bluetooth exploits: Instead of relying on constraints inherent in the protocol's standard operating procedures, attackers use particular weaknesses inside the protocol or its implementation to carry out an attack. Bluetooth is a very lengthy and complicated standard, which means there are more possibilities for flaws to arise in the protocol's code as well as for developers to make mistakes in their implementations. 

BlueBorne is a strong example of the damage that a Bluetooth-based assault may do. The BlueBorne vulnerabilities, first disclosed in 2017 and mainly fixed since then, are an attack vector that allows attackers to gain total control of a target device without having to pair with it or even having the device in discoverable mode. Bluetooth has enhanced privileges on nearly all operating systems, with components ranging from the hardware level to the application level, allowing for such control. 

Lastly, NFC is a technology that allows for payment between a smartphone and a retailer's terminal. Due to its limited range (approximately a mile), and fewer use cases, NFC attacks are possible. A malicious NFC tag on an Android device, for example, might immediately launch a malicious site in the user's browser if the device is unlocked. Weaponizing a malicious tag on iOS demands some social engineering, as a popup notifies the user that the tag wants to open a certain app; for example, in a transit station, the tag may request that the user open the most recent train timetable in their browser. 

Techniques to minimize risks: 

Although radio-based assaults on smartphones are frequently undetectable to the user and fall beyond the realm of most mobile security solutions, there are a few steps a user can take to protect their smartphone and data. 

Turning off radios (especially Wi-Fi and Bluetooth) while not in use or when in public is the most effective. If the smartphone permits it, disable 2G functionality to reduce the danger of IMSI catchers. Turn off auto-join for hotspots on Wi-Fi. Install security updates for Bluetooth as soon as they become available to ensure that any known Bluetooth flaws are addressed. 

If one often goes through chokepoints or known hostile regions, they should consider investing in a high-end Faraday case to protect against RF assaults (Faraday bags are generally inadequate against strong signals). The radios in smartphones are a crucial component of why these gadgets are so popular. People can escape being easy targets for the evil people with a little bit of knowledge and aggressive resistance against their misuse.
Read more »
Wifi vulnerability
Apple Bug iOS Vulnerabilities and Exploits WiFi Wifi vulnerability

Low-Risk iOS Wi-Fi Naming Issue can Compromise iPhones Remotely

 

According to recent research, the Wi-Fi network name issue that entirely disabled an iPhone's network connectivity had remote code execution capabilities and was discreetly patched by Apple earlier this year. 

On Monday, Apple released iOS 14.7 for iPhones, which includes bug fixes and security improvements as well as a remedy for the Wi-Fi denial-of-service issue. However, the company has not yet provided security information that may suggest whether its vulnerability has been fixed. 

The denial-of-service vulnerability, which was discovered last month, was caused by the way iOS managed string formats associated with the SSID input, causing any up-to-date iPhone to crash when connected to wireless access points with percent symbols in their names, such as "%p%s%s%s%s%n." 

While the problem could be solved by resetting the network settings (Settings > General > Reset > Reset Network Settings), Apple is likely to provide a fix in iOS 14.7, which is currently accessible to developers and public beta testers. 

Researchers from mobile security automation business ZecOps discovered that the same flaw could be abused to accomplish remote code execution (RCE) on targeted devices by simply adding the string pattern " % @" to the Wi-Fi hotspot's name, which may have had far-reaching repercussions. 

The issue was termed "WiFiDemon" by ZecOps. It's also a zero-click vulnerability as it allows a threat actor to infect a device without needing user interaction, however, it does necessitate that the setting to automatically connect Wi-Fi networks is enabled (which it is, by default). 

"As long as the Wi-Fi is turned on this vulnerability can be triggered," the researchers noted. "If the user is connected to an existing Wi-Fi network, an attacker can launch another attack to disconnect/de-associate the device and then launch this zero-click attack." 

"This zero-click vulnerability is powerful: if the malicious access point has password protection and the user never joins the Wi-Fi, nothing will be saved to the disk," the company stated. "

After turning off the malicious access point, the user's Wi-Fi function will be normal. A user could hardly notice if they have been attacked.

The RCE variant was discovered to be exploitable in all iOS versions before iOS 14.3, with Apple "silently" fixing the problem in January 2021 as part of their iOS 14.4 release. The vulnerability was not issued a CVE identifier. 

Given the vulnerability's exploitability, iPhone and iPad owners must update to the most recent iOS version to reduce the risk associated with the flaw.
Read more »
WiFi
Bug iPhone Vulnerability and Exploits WiFi

This iPhone Bug Exists Even After Network Settings Reset

 

Two weeks after the iphone wifi bug was found, the same cybersecurity analyst Carl Schou discovered a similar different case. The expert in a tweet said that if an iPhone comes within a wifi network range called ‘%secretclub%power,' then the connected iphone wouldn't be able to use wifi or any other features related to it. The bug exists even if the user resets network settings, says Schou. 

9TO5Mac reports "Obviously, this is such an obscure chain of events that it is highly unlikely that any person accidentally falls into this unless a load of Wi-Fi pranksters suddenly pop up in the wild with open Wi-Fi networks using the poisoned name. Until Apple fixes this edge case in a future OS update, just keep an eye out for any Wi-Fi networks with percent symbols in their name." The only solution to fix the bug would be a factory reset of the iphone. 

However, the experts advise not to do it as it is not tested. The earlier problem was related to iPhones facing a network name with the SSiD “%p%s%s%s%s%n," however, the issue could be fixed by simply resetting the iphone in the network settings option. But the new problem has more threat as it can affect any device which comes into the range of the infected public wifi named 'secretclub%power.' However, it is clear that both the bugs are somewhat related as ‘%secretclub%power’ and ‘%p%s%s%s%s%n' exploit string format code vulnerability which lies somewhere in the iOS network stack. Schou tweeted "You can permanently disable any iOS device's WiFI by hosting a public WiFi named %secretclub%power. Resetting network settings is not guaranteed to restore functionality." 

As of now, it is clear that there exist many variants of network name bugs that use ‘%s’, ‘%p’, and ‘%n’ character sequences. From the user's perspective, the best way to stay safe from the bug is to avoid connecting your device to wifi networks that contain '%' symbols in their names. iOS users can only wait for the next update when Apple will fix the OS bug. "Here’s a funny bug: a security researcher has found that a carefully crafted network name causes a bug in the networking stack of iOS and can completely disable your iPhone’s ability to connect to Wi-Fi," reported 9TO5Mac previously.
Read more »
Subscribe to: Posts (Atom)